5ebb03c31ce8fd106b3b0ef516673e978b2340739b3a1f814bd3fef796620014

Analysis

max time kernel
25s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 31.8MB
Sample260730-qqh55aab97
SHA256 5ebb03c31ce8fd106b3b0ef516673e978b2340739b3a1f814bd3fef796620014
MD5 ccbc5766581180c6f5772ad8ef6bb680
SHA1 0f2b82ae5369fa1ee8dd820628f029b94b4ae8d7
SHA512 aab0ee0dae63a1495a0e9d9bc794d15cfe276c1bc8ee2b8ca87bf01341be4c62be7f7341d7e9ab58d25dc9fef97202ecd46fe468ed62453e51fa5f04d9bed1e1
SSDEEP 786432:5o3bwbB0+IbCLU6LGwaC32PBD+gEwLKbuO0LhXMqN+2SU5D:5hq+ohC3+BDO0mu1LlLB
TLSH
T18B7733B9228580BDFCEB923086135285BF626D14DF69C6DF05AD68537D732F0913CAB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4596	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4596	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4596	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4596	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 29 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
13876	cmd.exe
14288	cmd.exe
17312	cmd.exe
17820	cmd.exe
5416	cmd.exe
10372	cmd.exe
1692	cmd.exe
10556	cmd.exe
12124	cmd.exe
12312	cmd.exe
5016	cmd.exe
4284	cmd.exe
12828	cmd.exe
13488	cmd.exe
7388	cmd.exe
17036	cmd.exe
6856	cmd.exe
7804	cmd.exe
10892	cmd.exe
13068	cmd.exe
12632	cmd.exe
15700	cmd.exe
4864	cmd.exe
10840	cmd.exe
12736	cmd.exe
15608	cmd.exe
7380	cmd.exe
11820	cmd.exe
13728	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1748	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 4860	3232	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 4860 wrote to memory of 1708	4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 4860 wrote to memory of 4856	4860	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 4856 wrote to memory of 2772	4856	msedge.exe	93
PID 1708 wrote to memory of 1692	1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 1708 wrote to memory of 1192	1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	96
PID 4856 wrote to memory of 1748	4856	msedge.exe	98
PID 4856 wrote to memory of 4572	4856	msedge.exe	99
PID 4856 wrote to memory of 4572	4856	msedge.exe	99
PID 4856 wrote to memory of 1052	4856	msedge.exe	100
PID 4856 wrote to memory of 1052	4856	msedge.exe	100
PID 4856 wrote to memory of 1052	4856	msedge.exe	100
PID 4856 wrote to memory of 1904	4856	msedge.exe	101
PID 4856 wrote to memory of 1904	4856	msedge.exe	101
PID 4856 wrote to memory of 1904	4856	msedge.exe	101
PID 4856 wrote to memory of 2744	4856	msedge.exe	102
PID 4856 wrote to memory of 2744	4856	msedge.exe	102
PID 4856 wrote to memory of 2744	4856	msedge.exe	102
PID 4856 wrote to memory of 2076	4856	msedge.exe	103
PID 4856 wrote to memory of 4808	4856	msedge.exe	104
PID 4856 wrote to memory of 2076	4856	msedge.exe	103
PID 4856 wrote to memory of 2076	4856	msedge.exe	103
PID 4856 wrote to memory of 4808	4856	msedge.exe	104
PID 4856 wrote to memory of 4808	4856	msedge.exe	104
PID 4856 wrote to memory of 2620	4856	msedge.exe	105
PID 4856 wrote to memory of 2620	4856	msedge.exe	105
PID 4856 wrote to memory of 2620	4856	msedge.exe	105
PID 1708 wrote to memory of 4980	1708	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	106
PID 4856 wrote to memory of 5504	4856	msedge.exe	107
PID 4856 wrote to memory of 5504	4856	msedge.exe	107
PID 4856 wrote to memory of 5504	4856	msedge.exe	107
PID 1192 wrote to memory of 5416	1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	108
PID 4856 wrote to memory of 3128	4856	msedge.exe	111
PID 4856 wrote to memory of 3128	4856	msedge.exe	111
PID 4856 wrote to memory of 5280	4856	msedge.exe	112
PID 4856 wrote to memory of 5280	4856	msedge.exe	112
PID 4856 wrote to memory of 5280	4856	msedge.exe	112
PID 4856 wrote to memory of 2164	4856	msedge.exe	113
PID 4856 wrote to memory of 2164	4856	msedge.exe	113
PID 4856 wrote to memory of 2164	4856	msedge.exe	113
PID 4856 wrote to memory of 4964	4856	msedge.exe	114
PID 4856 wrote to memory of 4964	4856	msedge.exe	114
PID 4856 wrote to memory of 4468	4856	msedge.exe	115
PID 4856 wrote to memory of 4468	4856	msedge.exe	115
PID 1192 wrote to memory of 4596	1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	116
PID 1192 wrote to memory of 3160	1192	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	117
PID 4856 wrote to memory of 1204	4856	msedge.exe	118
PID 4856 wrote to memory of 1204	4856	msedge.exe	118
PID 4856 wrote to memory of 1204	4856	msedge.exe	118
PID 4596 wrote to memory of 4864	4596	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	119
PID 4856 wrote to memory of 2360	4856	msedge.exe	121
PID 4856 wrote to memory of 2360	4856	msedge.exe	121
PID 4856 wrote to memory of 2360	4856	msedge.exe	121
PID 4596 wrote to memory of 4148	4596	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	122
PID 4596 wrote to memory of 4736	4596	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	123
PID 4856 wrote to memory of 5976	4856	msedge.exe	124
PID 4856 wrote to memory of 5976	4856	msedge.exe	124
PID 4856 wrote to memory of 5976	4856	msedge.exe	124
PID 4856 wrote to memory of 1972	4856	msedge.exe	125
PID 4856 wrote to memory of 1972	4856	msedge.exe	125
PID 4856 wrote to memory of 1972	4856	msedge.exe	125
PID 4148 wrote to memory of 4284	4148	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	126
PID 4148 wrote to memory of 2256	4148	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	128
PID 4148 wrote to memory of 4772	4148	2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4596
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        Executes a command shell one-liner
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        Executes a command shell one-liner
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        7⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        8⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        9⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        10⤵
        
        PID:6616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        11⤵
        Executes a command shell one-liner
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        11⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        12⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        13⤵
        
        PID:5736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        14⤵
        Executes a command shell one-liner
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        14⤵
        
        PID:7576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        15⤵
        Executes a command shell one-liner
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        15⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        16⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        17⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        18⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        19⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        20⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        21⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        22⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        23⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        24⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        25⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        26⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        27⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        28⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        29⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        30⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        31⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        32⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        33⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        34⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        35⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        36⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        37⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        38⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        39⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        40⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        41⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        42⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        43⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        44⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        45⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        46⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        47⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        48⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        49⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        50⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        51⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        52⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        53⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        54⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        55⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        56⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        57⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        58⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        59⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        60⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        61⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        62⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        63⤵
        
        PID:840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        64⤵
        Executes a command shell one-liner
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        64⤵
        
        PID:10972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        65⤵
        Executes a command shell one-liner
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        65⤵
        
        PID:10432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        66⤵
        Executes a command shell one-liner
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        66⤵
        
        PID:10980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        67⤵
        Executes a command shell one-liner
        
        PID:10840
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        67⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        68⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        69⤵
        
        PID:11552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        70⤵
        Executes a command shell one-liner
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        70⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        71⤵
        
        PID:11392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        72⤵
        Executes a command shell one-liner
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        72⤵
        
        PID:11708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        73⤵
        Executes a command shell one-liner
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        73⤵
        
        PID:12576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        74⤵
        Executes a command shell one-liner
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        74⤵
        
        PID:12996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        75⤵
        Executes a command shell one-liner
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        75⤵
        
        PID:1592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        76⤵
        Executes a command shell one-liner
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        76⤵
        
        PID:13136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        77⤵
        Executes a command shell one-liner
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        77⤵
        
        PID:13316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        78⤵
        Executes a command shell one-liner
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        78⤵
        
        PID:13688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        79⤵
        Executes a command shell one-liner
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        79⤵
        
        PID:14112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        80⤵
        Executes a command shell one-liner
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        80⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        81⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        82⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        83⤵
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        84⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        85⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        86⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        87⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        88⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        89⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        90⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        91⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        92⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        93⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        94⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        95⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        96⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        97⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        98⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        99⤵
        
        PID:15096
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        100⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        101⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        102⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        103⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        104⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        105⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        106⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        107⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        108⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        109⤵
        
        PID:8716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        110⤵
        Executes a command shell one-liner
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        110⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        111⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        112⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        113⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        114⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        115⤵
        
        PID:15612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        116⤵
        Executes a command shell one-liner
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        116⤵
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        117⤵
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        118⤵
        
        PID:15976
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        119⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        120⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        121⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        122⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        123⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        124⤵
        
        PID:15624
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        125⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        126⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        127⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        128⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        129⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        130⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        131⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        132⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        133⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        134⤵
        
        PID:2248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        135⤵
        Executes a command shell one-liner
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        135⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        136⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        137⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        138⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        139⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        140⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        141⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        142⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        143⤵
        
        PID:16324
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        144⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        145⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        146⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        147⤵
        
        PID:13660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        148⤵
        Executes a command shell one-liner
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        148⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        149⤵
        
        PID:15328
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        150⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        151⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        152⤵
        
        PID:16480
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        153⤵
        
        PID:16584
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        154⤵
        
        PID:16680
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        155⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        156⤵
        
        PID:16900
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        157⤵
        
        PID:16996
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        158⤵
        
        PID:17100
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        159⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        160⤵
        
        PID:17316
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        161⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        162⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        163⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        164⤵
        
        PID:204
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        165⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        166⤵
        
        PID:17072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        167⤵
        Executes a command shell one-liner
        
        PID:17312
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        167⤵
        
        PID:17296
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        168⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        169⤵
        
        PID:16932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        170⤵
        Executes a command shell one-liner
        
        PID:17036
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        170⤵
        
        PID:17216
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        171⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        172⤵
        
        PID:16516
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        173⤵
        
        PID:17004
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        174⤵
        
        PID:17304
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        175⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        176⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        177⤵
        
        PID:15420
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        178⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        179⤵
        
        PID:3288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        180⤵
        Executes a command shell one-liner
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        180⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        181⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        182⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        183⤵
        
        PID:17492
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        184⤵
        
        PID:17608
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        185⤵
        
        PID:17704
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        186⤵
        
        PID:17828
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        187⤵
        
        PID:17928
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        188⤵
        
        PID:18036
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        189⤵
        
        PID:18140
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        190⤵
        
        PID:18232
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        191⤵
        
        PID:18332
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        192⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        193⤵
        
        PID:17536
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        194⤵
        
        PID:17692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        195⤵
        Executes a command shell one-liner
        
        PID:17820
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        195⤵
        
        PID:17808
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        196⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        
        C:\Users\Admin\AppData\Local\Temp\2026-07-30_ccbc5766581180c6f5772ad8ef6bb680_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -m pip install requests -q
        197⤵
        
        PID:18172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        197⤵
        
        PID:18216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        196⤵
        
        PID:7712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        195⤵
        
        PID:17956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        194⤵
        
        PID:17812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        193⤵
        
        PID:13976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        192⤵
        
        PID:17472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        191⤵
        
        PID:18384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        190⤵
        
        PID:18280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        189⤵
        
        PID:18180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        188⤵
        
        PID:18076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        187⤵
        
        PID:17972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        186⤵
        
        PID:17884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        185⤵
        
        PID:17748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        184⤵
        
        PID:17652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        183⤵
        
        PID:17544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        182⤵
        
        PID:17440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        181⤵
        
        PID:4196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        180⤵
        
        PID:15412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        179⤵
        
        PID:6160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        178⤵
        
        PID:15552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        177⤵
        
        PID:14124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        176⤵
        
        PID:13328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        175⤵
        
        PID:8808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        174⤵
        
        PID:16748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        173⤵
        
        PID:7720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        172⤵
        
        PID:17032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        171⤵
        
        PID:16456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        170⤵
        
        PID:12600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        169⤵
        
        PID:8880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        168⤵
        
        PID:16568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        167⤵
        
        PID:14544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        166⤵
        
        PID:17300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        165⤵
        
        PID:16984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        164⤵
        
        PID:16976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        163⤵
        
        PID:16796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        162⤵
        
        PID:16616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        161⤵
        
        PID:16440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        160⤵
        
        PID:17356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        159⤵
        
        PID:17252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        158⤵
        
        PID:17172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        157⤵
        
        PID:17044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        156⤵
        
        PID:16944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        155⤵
        
        PID:16840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        154⤵
        
        PID:16736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        153⤵
        
        PID:16628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        152⤵
        
        PID:16528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        151⤵
        
        PID:16428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        150⤵
        
        PID:15708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        149⤵
        
        PID:15036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        148⤵
        
        PID:4676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        147⤵
        
        PID:15884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        146⤵
        
        PID:4808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        145⤵
        
        PID:8744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        144⤵
        
        PID:15772
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        143⤵
        
        PID:14500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        142⤵
        
        PID:16220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        141⤵
        
        PID:7016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        140⤵
        
        PID:15776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        139⤵
        
        PID:5048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        138⤵
        
        PID:16376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        137⤵
        
        PID:7212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        136⤵
        
        PID:828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        135⤵
        
        PID:15888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        134⤵
        
        PID:2680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        133⤵
        
        PID:8548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        132⤵
        
        PID:6520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        131⤵
        
        PID:9912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        130⤵
        
        PID:16268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        129⤵
        
        PID:5924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        128⤵
        
        PID:16112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        127⤵
        
        PID:16012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        126⤵
        
        PID:4116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        125⤵
        
        PID:10140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        124⤵
        
        PID:1860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        123⤵
        
        PID:8348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        122⤵
        
        PID:6376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        121⤵
        
        PID:16332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        120⤵
        
        PID:16232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        119⤵
        
        PID:16124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        118⤵
        
        PID:16020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        117⤵
        
        PID:15920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        116⤵
        
        PID:15808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        115⤵
        
        PID:15660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        114⤵
        
        PID:15544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        113⤵
        
        PID:15444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        112⤵
        
        PID:3944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        111⤵
        
        PID:6100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        110⤵
        
        PID:7268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        109⤵
        
        PID:14968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        108⤵
        
        PID:3732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        107⤵
        
        PID:4568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        106⤵
        
        PID:7936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        105⤵
        
        PID:15296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        104⤵
        
        PID:15292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        103⤵
        
        PID:8380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        102⤵
        
        PID:8836
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        101⤵
        
        PID:7848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        100⤵
        
        PID:15288
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        99⤵
        
        PID:15144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        98⤵
        
        PID:7384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        97⤵
        
        PID:8840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        96⤵
        
        PID:14640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        95⤵
        
        PID:14528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        94⤵
        
        PID:7992
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        93⤵
        
        PID:15244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        92⤵
        
        PID:15132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        91⤵
        
        PID:14928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        90⤵
        
        PID:14816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        89⤵
        
        PID:14712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        88⤵
        
        PID:14600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        87⤵
        
        PID:14484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        86⤵
        
        PID:14368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        85⤵
        
        PID:7240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        84⤵
        
        PID:13908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        83⤵
        
        PID:13884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        82⤵
        
        PID:9916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        81⤵
        
        PID:14076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        80⤵
        
        PID:13784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        79⤵
        
        PID:14152
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        78⤵
        
        PID:13740
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        77⤵
        
        PID:13372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        76⤵
        
        PID:12296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        75⤵
        
        PID:12416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        74⤵
        
        PID:13060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        73⤵
        
        PID:12652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        72⤵
        
        PID:11624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        71⤵
        
        PID:11404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        70⤵
        
        PID:12076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        69⤵
        
        PID:11668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        68⤵
        
        PID:11336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        67⤵
        
        PID:10756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        66⤵
        
        PID:11032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        65⤵
        
        PID:10500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        64⤵
        
        PID:11040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        63⤵
        
        PID:9320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        62⤵
        
        PID:10152
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        61⤵
        
        PID:9812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        60⤵
        
        PID:9756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        59⤵
        
        PID:9560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        58⤵
        
        PID:8012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        57⤵
        
        PID:9260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        56⤵
        
        PID:10164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        55⤵
        
        PID:10020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        54⤵
        
        PID:9880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        53⤵
        
        PID:9732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        52⤵
        
        PID:9596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        51⤵
        
        PID:9452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        50⤵
        
        PID:9316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        49⤵
        
        PID:4304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        48⤵
        
        PID:8548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        47⤵
        
        PID:768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        46⤵
        
        PID:8388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        45⤵
        
        PID:3892
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        44⤵
        
        PID:8656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        43⤵
        
        PID:8720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        42⤵
        
        PID:9044
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        41⤵
        
        PID:8504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        40⤵
        
        PID:8424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        39⤵
        
        PID:9076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        38⤵
        
        PID:2628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        37⤵
        
        PID:8388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        36⤵
        
        PID:9100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        35⤵
        
        PID:8884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        34⤵
        
        PID:1940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        33⤵
        
        PID:8504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        32⤵
        
        PID:8232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        31⤵
        
        PID:9048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        30⤵
        
        PID:8860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        29⤵
        
        PID:8572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        28⤵
        
        PID:8228
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        27⤵
        
        PID:7244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        26⤵
        
        PID:9032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        25⤵
        
        PID:8864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        24⤵
        
        PID:8668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        23⤵
        
        PID:8484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        22⤵
        
        PID:8340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        21⤵
        
        PID:7564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        20⤵
        
        PID:8128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        19⤵
        
        PID:7200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        18⤵
        
        PID:7812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        17⤵
        
        PID:7124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        16⤵
        
        PID:7268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        15⤵
        
        PID:8072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        14⤵
        
        PID:7632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        13⤵
        
        PID:7200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        12⤵
        
        PID:7128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        11⤵
        
        PID:2404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        10⤵
        
        PID:6720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        9⤵
        
        PID:6392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        8⤵
        
        PID:3944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        7⤵
        
        PID:4772
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        6⤵
        
        PID:4736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
        5⤵
        
        PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
      4⤵
      PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffbdacdc188,0x7ffbdacdc194,0x7ffbdacdc1a0
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,5473260640394599250,13109123513870238878,524288 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:11
      4⤵
      System Time Discovery
      PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,9130213869318471167,3934531201341734891,524288 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:13
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3356,i,6316036199183043204,17462387606016565320,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3364,i,17642435566723341549,3085028080261898162,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,6738649668769038253,12568199230386028759,262144 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:2
      4⤵
      PID:2744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,8682354136103155027,4233979634540207049,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,2746262909142292051,9627223732545882736,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:9
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3648,i,17065077864140648574,17494260107459545090,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:9
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5096,i,5115106013932208257,17077554102405504239,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,12928021907453720036,14280086411221331165,524288 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5792,i,7545404301801968485,16008488828659149297,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:15
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5892,i,13757351522595178486,16130303473703801421,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:15
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,7339328647265334672,1248221952956335550,524288 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,13333280024565049806,760591368675449792,524288 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6652,i,13417085665153270722,4704453637182104811,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6820,i,7043147397579414119,568301561800796043,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:15
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7052,i,4104819905543326711,9933474352497131814,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7208,i,1992839716845172861,10906962756721979451,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:15
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7444,i,2916606279548213016,1132495783315195489,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:1
      4⤵
      PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7616,i,9708937913385200995,9724886377221894440,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:15
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5640,i,16860039763777638228,11402457966043746152,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7116,i,10028892237128646803,15189619038825628718,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:15
      4⤵
      PID:6168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7904,i,4504352179168183430,17503353375986031040,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=8112 /prefetch:1
      4⤵
      PID:6416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8300,i,7080284452394230437,13486310377451042490,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=8280 /prefetch:15
      4⤵
      PID:6512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8420,i,17401028450204704634,10365235627676436241,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:1
      4⤵
      PID:6764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8636,i,4701970105427277993,12867290631236381110,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=8480 /prefetch:15
      4⤵
      PID:6864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8896,i,13887865574868413191,1736366538532049565,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=8912 /prefetch:1
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=9116,i,14062959443623799323,8458778551782706543,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=9104 /prefetch:15
      4⤵
      PID:6400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=9264,i,12953962362020651472,11260133510513004849,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=9284 /prefetch:1
      4⤵
      PID:7140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=9512,i,15356471947652034073,10895991858533820013,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=9548 /prefetch:15
      4⤵
      PID:6372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=9692,i,1412149899595772494,5313665543115125919,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=9696 /prefetch:1
      4⤵
      PID:7256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9976,i,1044369589656976855,11474500874329593228,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=9844 /prefetch:15
      4⤵
      PID:7372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=10112,i,15911267450452176191,9023044250093604414,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=10220 /prefetch:1
      4⤵
      PID:7680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=10408,i,15630395868373783949,14187618114271284538,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=10380 /prefetch:15
      4⤵
      PID:7796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=10720,i,1093727020002569510,3292449606419719828,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=10732 /prefetch:1
      4⤵
      PID:8096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,2551819179398797478,9801491287418807921,524288 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11096 /prefetch:14
      4⤵
      PID:8104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,2551819179398797478,9801491287418807921,524288 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11096 /prefetch:14
      4⤵
      PID:7424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=10892,i,4346041670105139971,7009831303145843029,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:15
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=11032,i,10239036348895780079,5091658625728779876,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:15
      4⤵
      PID:9436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10984,i,9596012936455176781,13049071919880312199,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:9312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=11084,i,9984157283344184075,9936108621428797221,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
      4⤵
      PID:9444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=11556,i,3859728506779486289,14098560701232729960,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
      4⤵
      PID:9352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=11572,i,2016188546952239448,10379894642443531176,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
      4⤵
      PID:7876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=11648,i,12369620810335013290,9038651466266669073,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=12520 /prefetch:1
      4⤵
      PID:7872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=12348,i,6335597816829492166,3308722840039523011,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11800 /prefetch:1
      4⤵
      PID:9456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=12104,i,11089879860301819740,3990426677582983460,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=10180 /prefetch:1
      4⤵
      PID:7184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=12220,i,13592194010044323559,13296615938877225256,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=12200 /prefetch:1
      4⤵
      PID:7568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=12296,i,17328116149905859693,12531159005638521897,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11848 /prefetch:1
      4⤵
      PID:7812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=11660,i,3275205812474686797,8748555199411640740,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
      4⤵
      PID:9420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=11828,i,14777726813043305137,8373502913402916738,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=12508 /prefetch:1
      4⤵
      PID:7788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12384,i,11988265968614532193,10895308877993089766,524288 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11780 /prefetch:14
      4⤵
      PID:7404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=12496,i,857653766322942774,12643576596907909718,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11296 /prefetch:1
      4⤵
      PID:9472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12360,i,8139609753001954870,17843604316983546756,524288 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11596 /prefetch:14
      4⤵
      PID:9484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=7248,i,3770699546704824482,3652400838579942428,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11812 /prefetch:1
      4⤵
      PID:9460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8784,i,10138709755163435047,6979602241061916565,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11584 /prefetch:1
      4⤵
      PID:9344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=10268,i,2639456719685984266,7682891652359372055,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11212 /prefetch:1
      4⤵
      PID:9520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8800,i,6787399622169351657,12221861460238973185,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11404 /prefetch:1
      4⤵
      PID:9580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=12196,i,8139447879632665360,15022834625078567489,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11492 /prefetch:1
      4⤵
      PID:9452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=12516,i,8545070165278336622,18089248504040828652,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11208 /prefetch:1
      4⤵
      PID:9600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=11884,i,8848019828713339902,13495457640489771893,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11424 /prefetch:1
      4⤵
      PID:9544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=12076,i,1450823725817577089,16176114520894563971,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11412 /prefetch:1
      4⤵
      PID:9640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=12664,i,2307870221382384132,15402410625398205666,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11316 /prefetch:1
      4⤵
      PID:7904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=10944,i,11699519674883300822,3319339457689549158,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11428 /prefetch:1
      4⤵
      PID:9604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12708,i,13470377407492679150,11178252667870846879,524288 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=12960 /prefetch:14
      4⤵
      PID:9632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=12764,i,8611822062358862401,12480638644432530914,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=11388 /prefetch:1
      4⤵
      PID:9496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=1288,i,8170433483119102184,9065247308635754495,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=12964 /prefetch:1
      4⤵
      PID:9624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1144,i,7012830284442772402,3468549221844527232,524288 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13048 /prefetch:14
      4⤵
      PID:9636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1464,i,9513842033880087374,1388382987420846,524288 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13192 /prefetch:14
      4⤵
      PID:9584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=12072,i,1812923699965300016,3497613853238216772,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13200 /prefetch:1
      4⤵
      PID:9676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=12040,i,12486983401465353386,12615114686877590365,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13280 /prefetch:1
      4⤵
      PID:9696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=12788,i,2984275172338057921,11551623233540215991,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13344 /prefetch:1
      4⤵
      PID:9768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=6224,i,12040965836095242751,1608199780403133623,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13336 /prefetch:1
      4⤵
      PID:9724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=12668,i,8587262814783146312,4017841931515822793,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13276 /prefetch:1
      4⤵
      PID:9736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=6528,i,5642524692122632909,17808229017365788891,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13288 /prefetch:1
      4⤵
      PID:6736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=12784,i,6226106603707738128,4901568056078168827,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13548 /prefetch:1
      4⤵
      PID:9664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=6536,i,16230298034804462376,11006884343395309046,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13352 /prefetch:1
      4⤵
      PID:9760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=1480,i,875241958965926677,7410864252918937492,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13316 /prefetch:1
      4⤵
      PID:9744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=11096,i,10965849602716983290,15753794837462414177,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13496 /prefetch:1
      4⤵
      PID:9784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=12640,i,12755463153522106416,5706510920909263730,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13508 /prefetch:1
      4⤵
      PID:9672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=6440,i,18194748883212628703,15950139277531937320,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13528 /prefetch:1
      4⤵
      PID:9748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10648,i,360805742341286333,9047103658559235177,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13720 /prefetch:1
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=1568,i,9792781749911178541,7042909274981889749,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13408 /prefetch:1
      4⤵
      PID:9756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=6484,i,123557487435574913,7547326121009398020,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13428 /prefetch:1
      4⤵
      PID:9732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=6472,i,12946145889778681385,16950393029974443352,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13396 /prefetch:1
      4⤵
      PID:9804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=11936,i,7977445975611392086,16071558127958177025,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13544 /prefetch:1
      4⤵
      PID:9896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=12704,i,272978053477201547,16724944109622100073,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13568 /prefetch:1
      4⤵
      PID:9828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=9908,i,17370871288612369323,15341919715361826461,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13712 /prefetch:1
      4⤵
      PID:9924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=12540,i,9529191884058088714,8006313916203429663,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13716 /prefetch:1
      4⤵
      PID:9800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=12332,i,3809573389489894420,5583238548779429409,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13816 /prefetch:1
      4⤵
      PID:9932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=12580,i,8705876617538882139,12507641285548211581,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13728 /prefetch:1
      4⤵
      PID:10036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=12616,i,4434772850768369750,1381384773599783525,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=13700 /prefetch:1
      4⤵
      PID:9848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=18832,i,3790024932554517062,7583013148436969919,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=19012 /prefetch:15
      4⤵
      PID:10116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=19208,i,7038972240040887327,13137012523105639770,524288 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=19232 /prefetch:14
      4⤵
      PID:10768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=19388,i,9695417069625291449,15659021923684225152,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=19240 /prefetch:1
      4⤵
      PID:11056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=19588,i,8569348735871038076,12571618407719151912,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=19612 /prefetch:15
      4⤵
      PID:11160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=19720,i,8541861898009509604,3007602141785635663,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=19768 /prefetch:1
      4⤵
      PID:10152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=19776,i,4756829213594868198,11057822831902888402,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=19792 /prefetch:15
      4⤵
      PID:10668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=20400,i,2113703428347236154,11379920556919712922,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=20380 /prefetch:1
      4⤵
      PID:10988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=20344,i,7911624787750161137,10938864527543493323,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=20356 /prefetch:15
      4⤵
      PID:10420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=20100,i,14416401353118402928,5170147833672416725,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=20604 /prefetch:1
      4⤵
      PID:11000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=20808,i,13757097304800694442,17603699890111331418,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=20656 /prefetch:15
      4⤵
      PID:10960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=20988,i,13709836968622095361,8330742804349662196,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=21076 /prefetch:1
      4⤵
      PID:11360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=21208,i,8295262753132945249,3845618676702145265,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=21228 /prefetch:15
      4⤵
      PID:11464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=21320,i,10496444485854120188,15719411661683346523,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=21352 /prefetch:1
      4⤵
      PID:11680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=21520,i,3881132577704253322,18321728342209348356,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=21548 /prefetch:15
      4⤵
      PID:11812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=21668,i,7216281194464429532,8728830768739354434,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=21560 /prefetch:1
      4⤵
      PID:12096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=22020,i,2163906235389663236,14125987050782454100,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=21860 /prefetch:15
      4⤵
      PID:12192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=1328,i,15430298272439822342,11424885315476717473,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=22196 /prefetch:1
      4⤵
      PID:11700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=22364,i,14458121433792417315,3935888553964879465,524288 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=22388 /prefetch:14
      4⤵
      PID:11856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=22572,i,12982316150528957658,14883132602066175765,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=22596 /prefetch:15
      4⤵
      PID:11912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=22900,i,4034456392721490433,9419802409027681348,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=22932 /prefetch:1
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=23140,i,17946901861488169175,8900556097609783274,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=23144 /prefetch:15
      4⤵
      PID:12388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=23788,i,13049955233068938079,8597891355374740406,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=22904 /prefetch:1
      4⤵
      PID:12720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=24000,i,5947994658322782944,14019763477786954651,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=23844 /prefetch:1
      4⤵
      PID:12796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=24168,i,4849773746162418943,14019981433780183277,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=23976 /prefetch:15
      4⤵
      PID:12812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=24172,i,10497103144654599407,3956840448483363622,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=24352 /prefetch:1
      4⤵
      PID:13092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=24536,i,13555492159603628965,17643999423036343518,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=24400 /prefetch:15
      4⤵
      PID:13208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=24704,i,7189743888166938666,3835975243155462502,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=24700 /prefetch:1
      4⤵
      PID:12400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=24892,i,2501976804248732601,18065632987497813433,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=24772 /prefetch:15
      4⤵
      PID:12712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=25064,i,5329487731363515811,18312984286726123328,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=24908 /prefetch:1
      4⤵
      PID:12380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --metrics-shmem-handle=25208,i,11632883359411423816,13212752921533358378,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=25228 /prefetch:15
      4⤵
      PID:12704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --metrics-shmem-handle=25468,i,6758692544876066830,10067545094480088708,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=25496 /prefetch:1
      4⤵
      PID:13416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --always-read-main-dll --metrics-shmem-handle=25672,i,5501600097104226715,5762242220146029767,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=25704 /prefetch:15
      4⤵
      PID:13496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --always-read-main-dll --metrics-shmem-handle=25912,i,9423507412392218045,5724525512240034891,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=25920 /prefetch:1
      4⤵
      PID:13772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --metrics-shmem-handle=26084,i,13188157936252200286,4573058168065515400,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=26108 /prefetch:15
      4⤵
      PID:13868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --metrics-shmem-handle=26468,i,2708775730157364669,5862543715906917870,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=26484 /prefetch:1
      4⤵
      PID:14184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --metrics-shmem-handle=26504,i,9384057456245073065,13304437420591591947,2097152 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=26672 /prefetch:15
      4⤵
      PID:14300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=27368,i,17015266110560168288,15165261410384802024,524288 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=27184 /prefetch:14
      4⤵
      PID:14232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=22796,i,14033537746838195143,13716239140348290211,262144 --field-trial-handle=2708,i,1601892645002546138,8083426070867174944,262144 --variations-seed-version --mojo-platform-channel-handle=27548 /prefetch:10
      4⤵
      PID:7596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8601bd9b6631c2979f2cd752dd84f11641c47193edff1b61b4d35a67f4365317
MD5 0f073c7ff1f5879d4b539f0572eccb79
SHA1 2fe1f4603f8fb2b5628bddc0e9d29b94e99ac93e
SHA512 bd0bf7881e5864c47f5b90461b503a2cde5f2dea220280f008eb489310b4b86b4cbc79507d6f1c6fdcc418f38a1c9796141c14014a2c7681aef07112e71ca367
TLSH
T116617143936825E3C7395EF864D548673239C8BA1B0B1E1ECCE6D5B0A6BEB5F2201427
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 37145dedd0378c73794ce6d3f72e536a86ad9888eba99878de61b43625b8b156
MD5 a99416ad26e590748771ed8de2485e20
SHA1 8567bf4b6841e4e210645611bd3166b748b702ba
SHA512 9a4112cf9c1559df28e699702d0c1abe4f0e87f1f9c8c726008e7b71e1b7ae7c52696f62f83416d8c8a23b8fca390378e3d8f15c414120dac6795f3dd5e2174a
TLSH
T1B731AFF3C3E8856E890196F0AA186E1BCE6D0A14832C3D5AC8E4EF1B93E3475D54199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e52c36d293692aae5895f5f561c13579e6243b604ae5e0a11db7c7d137de61bc
MD5 0f8f49c929aca26cf2ef7d7191609867
SHA1 6fcfeab279c076ff20ec09e960244c5b0ce3c3ee
SHA512 a8b910e7d5d53a574457ca23f4b16d69745bf2b85e387337d85c015c71815e5ad4f44d03d77e63d348305308557ce3d7e5f73c9e1145e5c76eb6f9841d487749
SSDEEP 192:sxR7wRBCy/fksr23smZtzoA8p4M/g6+WNIYxXEwmJ6GDIgD0pJ:sxR7w2y/fksa3S9/5IgENpq
TLSH
T1D642C816AA6899379CCBD21DFB557F53E6F91032A1D05E44EBFC9A0C04EA6CD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6d8ad58517dcddf900a4db6ef911071683f8914390b59e7d5e02a921c2c1450d
MD5 18572d18c7558e41ecd6981a0abd1b6f
SHA1 be4b35378b08ad3bcfba863cce401a6e9e655eac
SHA512 e8479a69612039eb761be45d8421cbe586ee395833df7a8bdaeb4764e5248c57f5f399c644d48642594a350c4395eeda18cca218ce6acb644042db4ff4442565
SSDEEP 192:sxR7LRBCy/fksW23smZtzoA8p4k/g6+WNIYxX3wmJ6GDIgVpJ:sxR7L2y/fksj3SN/5Ig3NpZ
TLSH
T10B42C7166A6899379CCBD21DFB567F53E6F91032A1D05E44EBFC9A0C04EA6CD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8c8ce71b21d74b479de7e74ca2a5e95109bed049494bcbbb07147fb822606843
MD5 85e36467e9adae5a702373a2bbbdd736
SHA1 4bb1094c69516b595f22a2eb677440881405840b
SHA512 2cae483e40ac51be4b477717d3adaa24302d40c43dbf801f8d1c00f2a907fcdb8f0e33343335d13d31c1a09a0c65ff474c17903f39e0fa492271681c9752ed37
SSDEEP 192:sxR7wRBCy/fksr2+iZF1zoA8p4R/g6+WNIYxuDwm06GDIgDWBJ:sxR7w2y/fksa+k2U/5IbDIpU
TLSH
T17242D81A6A6899379CCBD21DBB567F53D6F91032A1905E48FAFC9B0C04E66CE230741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 58a23e75901f8cdb8bb88180dde51099f964c6a7429b44f325c066a7fb4771b9
MD5 17ed3754f4f67617421d2aa465558c91
SHA1 3a89fb2dac22e117963f19742e3caf86660535df
SHA512 c0cb422cc6f9bcbd7d6b69b36d91e98ff82fe020ce7a3941827caa4c0bc7d5f024e6220419564454df5e233ee8f4eb92ebbaf63df233b12b92c460425a97299f
SSDEEP 192:sxR7wRBCy/fksr2+smZtzoA8p4M/g6+WNIYxuEwm06GDIgDWBJ:sxR7w2y/fksa+S9/5IbEIpU
TLSH
T1E742D81A6A6899379CCBD21DFB557F53E6F91032A1905E44EBFC9A0C04E76CE220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a219536d6d1eace94b7c9cde880bb1a564a3c7ca4e1439ab62c84a68434770f9
MD5 fb754220230f968c4990f7a99701db0d
SHA1 e4139d9d8fafc8ee484fd1a57b38f1b47631cb54
SHA512 ca74e26c25db70afbf906e6aa8f37bf3adc6e869b6fa6c8ec979f787034d763ce2f7a0f55213168332abdf1702cb607c1c431231576032042632cf24ea844c0a
SSDEEP 768:0YEy+s7pLuL7+jWgbrfp18F1+UoAYDCx9Tuqh0VfUC9xbog/OVQrVa9rol4vau:0YEy+QE7+jWgbrfp1u1jaPpa2liau
TLSH
T18FC2C97B740CCA7F4F804ADDA8197F9B7DA802CB96D8CD8047FA951C03C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b75df65d6c98bbfa7cceb80f5ccaa90c4d1cdb04aa5623f6f920e18a0fcc61a4
MD5 914e5d5d5be384c2167cd84030caab5c
SHA1 d39f964991aa86ee98385e717020084058ba2a3d
SHA512 956c5af8a090f3e9fc403129ed078104c5dea4b458068782504d77eb61a59db15fb245aaa7e3c9f78c0540d112c52386cb168366bc5f59d91a1543cce720bc56
SSDEEP 96:Kl1cT39njLET66mvLKOympLq1tiLj47EXAk2OOeE+pFmEeKOrmCeqcExSJwAK5CG:e3Flbj
TLSH
T1FD91D193B03A024429BD695C86A4D91ADAD274A3341CB56B3FB800F62F66F125FFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d33a7947-1235-420c-b63d-af35d2e43e0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d33a7947-1235-420c-b63d-af35d2e43e0c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e7beb1ab76af43fdda1f10815f6ab183a553b33d6936689232418763a141a03d
MD5 0db56ace023c9ac40f0ec183fa76cdfa
SHA1 f1cca352945efeadf7db342064f955971b38d614
SHA512 90fc70783cfd6168b9750accaec4e5f4bdb7504e440f20f4c0314764fd7308b6f8341daf3ff9b31040c2d4b7a2cc844927c91c8d1afc8d5d2cc92187a9315987
SSDEEP 768:na3pGCkKL24jF669yrqUjWiIwwxMtwb9Mz:na3OwjF66INWZTMOb+z
TLSH
T12DF2BE70ACA44EB3C9FADB8572523786AFB010A3D6D80F88D6DDE70D09475DD274782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a7e9b3f72e67f26839513db06830886c407b903942ed6e69b03a0e96d73b9caf
MD5 8b72af5deb2964372c6a3b7dcca1cc1e
SHA1 3a5e1a42f1e74250a4fa2335c07ad9de7a3bb579
SHA512 fc2da1f66686ca9261f05f38d33c4fce1aca19744b922123b4ef877a26c29ace18170f155d1c8b026fb5733aa0232fc015c71899d290553873427d667e09f71d
SSDEEP 768:9FQy3IwgnuRgnF669yrqUjWiIwwxMtwb9Mz:My3YnF66INWZTMOb+z
TLSH
T193038D75EC94CA7BD9F6DB86B2113786DEE010A3C6D88EC8DAC99E0D04870DD1747C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2c18167850239a5d1506eb118bf9017a8f423acaa3eeb0c9d20f87b066bf0f4e
MD5 26f1b09db6c4a59ea996e87902f03f64
SHA1 1969f828e8fa8cd23ffa0ff4b8c7bbe3e5baf8cb
SHA512 45aa59628fb651ad54cab0aceda15c8d33ed8d0c7ba3ab977a15ab034bbdbf41de69944cfc55bcba77f6126f3d82d29821e2ab04f49ba4e35accc99aa5a2fc63
SSDEEP 768:irv+4UNbdl3cfGkKL24jF669yrqUjWiIwwxMtwA:ibsbX36wjF66INWZTMOA
TLSH
T1FA03AE70B9689AB3CDF6D685B1123383BF7410A396C50F98D9CDAB0D058B4DD274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 52509e7a71b1192ab364423a8e44cd9b06e12bcc91e7d2be9de6990d90c81029
MD5 5a7a8206b12a7b29899c793b151c200c
SHA1 3afbc6e6fce56e252210385c0b216b07ba7e5caf
SHA512 e7706998b3b56e32b190742644a7ce194658202ece8f3ed42155ec4e1b2f107b191f34bef1c12611f2045f1fd3ab2ab6b045ff3f3d21827498f46c2efb87d907
SSDEEP 768:Yrv+4UNbdl3yQikKL24jF669yrqUjWiIwwxMtwe:YbsbX3HwjF66INWZTMOe
TLSH
T12203AE70B9689AB3C9F6D685B1133783BF7410A396C50F98D9CDAB0D058B4DD274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fb77999425ffd36107177003640b46839e70f1b457e12407cab311a6f520fe50
MD5 861ab8bb46b320b3615a6a3f830ef177
SHA1 46038f4c01214153d557e908e4c30c4982e915b5
SHA512 d6d4dc69e37b399469653e956d5004001877016da6f7d0c3ec419e7e3ac9ebfb29ef8966584f0ef1bd043fea3190d9cb974a1dd45ffd3273bdcfe0bc116cb945
SSDEEP 768:crv+4UNbdl3cJqnkKL24jF669yrqUjWiIwwxMtwA:cbsbX3cwjF66INWZTMOA
TLSH
T16E03AE70B9689AB3CDF6D685B1133383BF7410A396C50F98D9CDAB0D059B4DD274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2470f177a29be02f8e97a1d2221ea8424981f7c70f8f41400968ce02b2b19bf6
MD5 e75d1398e1103ca3ddedf048fcada7c9
SHA1 35c51a60e83d3c62afd4c1f82e8e0b84a4107c70
SHA512 10c24d00a4a9dfad80ec01524a080722fb63a4a554bf6e1011d77cc30b86e63b25a83edee720f47a30e4d0cae52014cb2c4059cbdcb3dd1c20a6d732e7fa2c58
SSDEEP 768:Vrv+4UNbdl3chWkKL24jF669yrqUjWiIwwxMtwA:VbsbX3IwjF66INWZTMOA
TLSH
T1A703AE70B9689AB3CDF6D685B1533383BF7410A396C50F98D9CDAB0D058B4DD274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 453c947bf8f12604cdb3cd92f9c582036768e01f8230658980e8ad231ae682b4
MD5 47b65d602d9c688fa5f1e5e60b3880eb
SHA1 6a0041155ece972935ed16e2f2f1efe015824fdb
SHA512 483678e8a0004da64d87a570c9d5ea7e2d7f284469a53527fb629a71903db5b9e897d831473059279d41f4c60a93b3393eefaa22979196cb0b59d781ffab58a2
SSDEEP 768:Vrv+4UNbdl3c6ykKL24jF669yrqUjWiIwwxMtwA:VbsbX3DwjF66INWZTMOA
TLSH
T12203AE70B9689AB3CDF6D685B1133383BF7410A396C50F98D9CDAB0D058B4DD274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 88ce083eb7468a1a71456cd4ed94d1f42dfd8563710c69329bd15ed6f329f743
MD5 54bc9d12f045a2b4cc3d021cbcfcd6bb
SHA1 c1299c0e1975eeaccd3b84fd42752bff55064f18
SHA512 42baaec7379457dcf12c4d8d1873918c1f61f0980f425124169e5a331a88eb07123cb3488136e8f59296f37e89142d1c16874ec0f9d35c0a5e9400df0a7f3907
SSDEEP 768:2rv+4UNbdl3254kKL24jF669yrqUjWiIwwxMtwA:2bsbX38wjF66INWZTMOA
TLSH
T1B403AE70B9689AB3CDF6D685B1133783BF7410A396C50F98D9CDAB0D058B4DD274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7e782788b08295bb396212bda3d5e66ef4c8408e62cc517cb13bfc49b96634bd
MD5 cd82cd41ee41f81cf522c64ed7e3d66b
SHA1 171b929507a53e220c42070fae3a54b51d5ca129
SHA512 f71f0bd653a0b5e93b1f32cbe9bb068c5790dac26a1d62e1f48d6a64a13287b44e42f63abd8bdbb964360a9b6bf017d99a8736f77c66f68737e8cc51e28b5df0
SSDEEP 768:Qa32qOkKL24jF669yrqUjWiIwwxMtwb9Mz:Qa31wjF66INWZTMOb+z
TLSH
T1C1F2AE70ACA48EB3C9FADB8572523786AFB010A3D6D40F88D5DDE70D09474DD274782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 781de282a69470832e294f5e1793548f76e8bafc0b0986851b956419444baf53
MD5 e447e82800bd98950e3c4bdd4e6b46d7
SHA1 481353b9d5b7e2726f7f3a079ff6e633a66200b0
SHA512 7ee4db5eb247186c435213017c79bd010348a38dbc06a3a63cdc3ab07ece5ae95210fea2cba8d9095cdac21ed212e0f9918edf9c1a75e1230346729a5ac5f778
SSDEEP 768:ia3pVOkKL24jF669yrqUjWiIwwxMtwb9Mz:ia3xwjF66INWZTMOb+z
TLSH
T176F2AE70BCA44EB3C9FADB8572523786AFB010A3D6D80E88D6DDE70D09475DD274782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 32c745d359d7fca63607b2da7becfa64ed73e38891a60ca217b4036434fec5c1
MD5 dad2cc75958612f7a251d8ed1a7a32b9
SHA1 c825954cf920e51f8c515d4b37d92ceb0883e8fc
SHA512 dbc24df0264672cc805f1ced60b2182a7a31c51dbb86d7dee8d0e3ae7366739d7984be86920b57f5f735c71ec029d83150d3fa3307b7ac55517d7940b401127f
SSDEEP 768:1a3pywkKL24jF669yrqUjWiIwwxMtwb9Mz:1a38wjF66INWZTMOb+z
TLSH
T121F2AE70BCA44EB3C9FAD74572523786AFB010A3D6D80E88D6DDE70E09475DD274782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e9a02f0d1602a14c00ea217f71d6b79a7902ad06e7b075fc867dcaa43c75b2f2
MD5 bb5c224fa847cbe37ad633ec0530c524
SHA1 970a2c7b681b7aa74c5ea1d3408faa206c26ec56
SHA512 e8d3fb4664fdca5a6cdadb1fd40837c348b17219ebc90660e30d1ae031a67c46a4da9c5e4bc987cb400a950533a196493902aec6a21ac207497ead58c5cb0f5f
SSDEEP 768:Ma3pxWkKL24jF669yrqUjWiIwwxMtwb9Mz:Ma3NwjF66INWZTMOb+z
TLSH
T13CF2BE70BCA44EB3C9FAD78572523782AFB010A3D6D80E88D6DDE70D09475DD274782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2b1cd6b74aa1f84894558fd6ab20169e2ccbc7a8364f3e3d3af70579db7f1329
MD5 069f53b6a1cfa5481224dc302a71eb08
SHA1 d148432b61e8a5eee8d88864111622ea4ef36c3f
SHA512 4e4d1d03cd031da7b156439299301be7585bbed8a1424659ef6c75766e129d071f1e58cc9bd3f765a9d98ecc5f101d4d3d153ef0a97915de410f996a20c18fbb
SSDEEP 768:2a3peokKL24jF669yrqUjWiIwwxMtwb9Mz:2a3YwjF66INWZTMOb+z
TLSH
T149F2AE70BCA44EB3C9FADB8572523786AFB010A3D6D80E88D6DDE70D09475DD274782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6606d2700e0a22dee68c85bc3e2b8c6cfac21206c1d23f1fc5142ba59a694cca
MD5 e1c8ba0470a6ff2bf3a2c327ed0e4cf3
SHA1 511c2ed42ce3f622cc114b21ed47f1fe1dac0aea
SHA512 fa04e52f692acffef6a079366a54b13d33856d11e4a29ca67f708a947b292ca76d2c6e5e9209a7685ffbb2898b140062b74f44f993be41dcbd803fb354e0a45e
SSDEEP 768:Ca3pjOkKL24jF669yrqUjWiIwwxMtwb9Mz:Ca37wjF66INWZTMOb+z
TLSH
T1DAF2AE70BCA44EB3C9FADB8572523786AFB010A3D6D80E88D6DDE70D09475DD274782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d03cda55b4e7fe64f5282219ab246b3d7343d0b143000e1bea63ebf22d95286b
MD5 3a54d4c668ff5e1b6beb9df22317f91d
SHA1 88f78cf32a2ce30bc9c69a6fef714a6b7fb897e0
SHA512 33cf049931be1cc61ce992321a06edfb1caf6dabf4cae8d7b662dddb41f0defb9a3082be31e0a31cf834a9e233b46bd93d6d526c7b4f5e2fd406bef9b88237b1
SSDEEP 768:va3pQskKL24jF669yrqUjWiIwwxMtwb9Mz:va3ewjF66INWZTMOb+z
TLSH
T177F2AE70BCA44EB3C9FADB8572523786AFB010A3D6D80E88D6DDE70D09475DD274782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a09659d1be5de57c6044ac86c28dc4d1171aecf19bfe78ce956952dbf6d8167f
MD5 b9cd7de1b742df2845e1cefcd42adcbb
SHA1 c1aaa734547be1d9dee1003660cfb5a7a9a0dc09
SHA512 6b1d8a999b0121951945a045859537dac0610d7c89f10c62f8ad4dd4fd10be9a60f10fe6b2495e9bbd96f01db9046c8e42d4e1a4b8cd8f82c7d86ad864562021
SSDEEP 768:dFQa3hwgn05afF669yrqUjWiIwwxMtwb9Mz:sa3VfF66INWZTMOb+z
TLSH
T1DB038D75EC94CA7BD9F6DB86B2513786DEE010A3C6D88EC8DAC89E0D04874DD1747C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6f0addebc279522cd44c8af8c3389abaedb4c3e98c9569a56b90fd5b72e3a797
MD5 0d79891b2ba07bb69e0005ded242c119
SHA1 dac7c3dce3c6ec904fb951f72df6cc075b3b0311
SHA512 a3598c431bc55254ffa97401542124f777d86400ad97d9316262caf5d44ff4877f2a215970bae1195723dcb9053598a5a6833296ae974d0a5deefdb6f4def310
SSDEEP 768:WFQa3hwgnHbafF669yrqUjWiIwwxMtwb9Mz:da3mfF66INWZTMOb+z
TLSH
T159038D75EC94CA7BD9F6DB86B2513786DEE010A3C6D88EC8DAC89E0D04874DD1747C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 10691883f9532aa0e89b22c19089ede3094656781a6b85470b0b82875e1c88db
MD5 05beab74767c58b32c5c7d094e8d2f80
SHA1 a3e234043fc3bba27daa8d297cb5f9ff44ba6439
SHA512 aebe191ab658a03175076812594bd5ddb41d030851c36aa3526c45228cf584ef056c06b29c88d1c3ad5ffcf4938eda3f29cd3947c853bd4ec5fe726dc0e65602
SSDEEP 768:mFQa3hwgnCBafF669yrqUjWiIwwxMtwb9Mz:ta3nfF66INWZTMOb+z
TLSH
T106038D75EC94CA7BD9F6DB86B2513786DEE010A3C6D88EC8DAC89E0D04874DD1747C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 639590f18b88f0b4efff41b35d1b3a965d821580738a1c2bc1557a72ee451bfa
MD5 1632becd1351f32399f66f0e97a97871
SHA1 300b2f4563827ac3b5aa2067caf3c6fa14f1ab87
SHA512 c876fce9aee06bbedefc5a8f2e539c0e7e0743cb86e18cff3636793bace21499d9502262d638e6e8e9740fc4fba4c3d8e21bd01fdfc4deb39b33bdf9971c1d43
SSDEEP 768:uFQa3hwgnl3afF669yrqUjWiIwwxMtwb9Mz:Fa3YfF66INWZTMOb+z
TLSH
T1AE038D75EC94CA7BD9F6DB86B2513786DEE010A3C6D88EC8DAC89E0D04874DD1747C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f77df70241390ff3115e7334b5601e348356dc42174169d8b106f60f44337066
MD5 43ec42f718c8b4ab2fc5c4a75a4d2d46
SHA1 20bd90670c204471f1868648dedfd319d6cdfcce
SHA512 6b838c2423357a17088b004baa8327c22f2e736f20e1618fa999d4e80f14b22b2b01305c1a480d4064fe8a05b06fcfe5ad80a2a0d3064f0a35895082745af3eb
SSDEEP 768:wFQa3hwgngZafF669yrqUjWiIwwxMtwb9Mz:ja3xfF66INWZTMOb+z
TLSH
T176038D75EC94CA7BD9F6DB86B2513786DEE010A3C6D88EC8DAC89E0D04874DD1747C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7ac0e7f50eb0201e34d32a2fce670178c743df70bbc0e5691afbadaa52afc5b0
MD5 ec328ea9944b253a1aea02b58339c076
SHA1 8613488612b1fd624eedc3e179f1aed9cb44911b
SHA512 78d3dd096895dfc2c50dcd2c57264ac6ef7c556c75ae0e59132c84b426ec3ca6a7011dd7c23dec5d4316b453242fd7eec2d91efccbad61790acef1ef3beda7ff
SSDEEP 768:drv+4UNbdl3cKmkKL24jF669yrqUjWiIwwxMtwA:dbsbX3XwjF66INWZTMOA
TLSH
T1D203AE70B9689AB3CDF6D685B1533383BF7410A396C50F98D9CDAB0D058B4DD274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a9f8c4bf505b2670ada5719cd4a0017473e3a152109855d2607a3d5192c07cd7
MD5 374062fc62b0156f855bd1120ebd7bab
SHA1 0655879e9f268c6bc220588f881e8eace869afbc
SHA512 fa31725bc3009541c19d9d5a0f53d7999f3191e77c63f2fb346dd5112fa0040c709ce6709afda39920520bca9107a5ae75c14c2beb35eaf8618de5b9038c2002
SSDEEP 768:7rv+4UNbdl3cDWkKL24jF669yrqUjWiIwwxMtwA:7bsbX3+wjF66INWZTMOA
TLSH
T15F03AE70B9689AB3CDF6D685B1133783BF7410A396C50F98D9CDAB0D058B4DD274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8315556632e5f449397edb824501941d11fa367d1728860bca38e9ee27944220
MD5 70b28279b8928da2fa0717eaad9ec928
SHA1 436e4300c35e12d30d02b45a920ec8d6009423b6
SHA512 df3102a88aade73479d593879434816be72280db4071911ffc88e6e025a482777dc130d7b9cf71f0f919fa0851eaea9e3642f0267c9eb5b6e414b7b910b879ab
SSDEEP 768:Xrv+4UNbdl3csqkKL24jF669yrqUjWiIwwxMtwA:XbsbX3xwjF66INWZTMOA
TLSH
T1ED03AE70B9689AB3CDF6D685B1123783BF7410A3D6C50F98D9C9AB0D058B4DD274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e4675d71c7a71db30c28a524d13de7f062321b0b6709bf37ad33b53b1df33424
MD5 80139148bd8f78f1d251f9e7ba26c785
SHA1 9853b202038109d13e826f2636f4d2e9f070d758
SHA512 c97d6f88af94d785c19dab0afbcceab1f5a146d5f9d48152d39a0244cd2304354623782084e6ed3d5f11696e41a9d680cb578015ae78528dbdde249350746451
SSDEEP 768:yrv+4UNbdl3cWmkKL24jF669yrqUjWiIwwxMtwA:ybsbX37wjF66INWZTMOA
TLSH
T16403AE70B9689AB3CDF6D685B1123383BF7410A396C50F98D9CDAB0D058B4DD274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9749972a1e117df1ac190762cabf00cef055c5ba2c9cb641655c769e286b8664
MD5 15788c9f944602b4241441b3479360f2
SHA1 ad6dc21b12d05cea671da54d656ed75f1c61e39a
SHA512 2286b888e08895f58b48e23bfcb808a94ea95694aa6b587c1223ce23556f5e066203620ab9a2a17aa6626beae112d55ed2455c7b016993b65629ad400100c251
SSDEEP 768:arv+4UNbdl3coykKL24jF669yrqUjWiIwwxMtwA:absbX31wjF66INWZTMOA
TLSH
T14903AE70B9689AB3CDF6D685B1123383BF7410A396C50F98D9CDAB0D058B4DD274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e97c16562a438857ae884341eb74da424e9eda0b919b099d578add5f6420fe91
MD5 9c2682af62da2aa760d0cd022cd7d2be
SHA1 5766d54288c28c88360fa31ab37fc13a0d809e65
SHA512 f8472b8c28e08e447ddd4acb5a43bbb56c4776761bf0f33c666371696cbd1b42b2b38cd31fc6c7d9d29520144afeb534a463676abd42124fb5638594de74e28d
SSDEEP 768:9rv+4UNbdl3czwkKL24jF669yrqUjWiIwwxMtwA:9bsbX3EwjF66INWZTMOA
TLSH
T1AC03AE70B9689AB3CDF6D685B1133383BF7410A396C50F98D9CDAB0D058B4DD274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 207436309b3b66f39af12dbc5e017a4589b00bb085e8b43cc01c677e8749c4d0
MD5 91f5bd67d86270f25b30f738b57ec8d8
SHA1 3712d03fa65e79e44fd77c356538d7ba6f45a54f
SHA512 e0e9c7ce0986c37267c0ae1fc72b8336b6aeee56a29f34191fd0b61acf9ceafb6e6682811da31e8e5ccaf234a65c20e44346508a08f77cf3868c6540639afcb7
SSDEEP 768:0rv+4UNbdl32A+kKL24jF669yrqUjWiIwwxMtwA:0bsbX37wjF66INWZTMOA
TLSH
T1B803AE70B9689AB3CDF6D685B1133783BF7410A396C50F98D9CDAB0D058B4DD274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b9c769ac6097bb31dae141e119627bb973005b1995b3c9793875ec002007adf8
MD5 3c26fe1c7b57ff65b51b3516d26abfbd
SHA1 8d1922a922a4761e80453236b6d8621459fa73be
SHA512 23c6cce962cc9bc18b3f80d0f765dea9cfab65898e5fd297b8cecc9e3d274b1bf0204ae36206f29821862417f11766f9167f63e8980f985e2e0dc8d21c64b900
SSDEEP 768:3a3pk8kKL24jF669yrqUjWiIwwxMtwb9Mz:3a3iwjF66INWZTMOb+z
TLSH
T1ECF2AE70BCA44EB3C9FADB8572523786AFB010A3D6D80E88D6DDE70D09475DD274782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7ceefdf6163916ee0ca521a13d9f72807b988d0e34210237238f3ac16df53268
MD5 2575a145106b187ef72e285aa12a5fdb
SHA1 8d2fb6de14ee57974977c677f93b3e9645f68d77
SHA512 2028993ed88ef9f377984a94565c158e79bfd5b5886c095b9bd5dd5627334a6b6f3d76b2513691629385419b7df3a41777b12c1bd357603bf80d12634ccd66c9
SSDEEP 768:5FQa3hwgnN7afF669yrqUjWiIwwxMtwb9Mz:4a3EfF66INWZTMOb+z
TLSH
T19E038D75EC94CA7BD9F6DB86B2513786DEE010A3C6D88EC8DAC89E0D04874DD1747C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 dcb74412d3b9551fc79a0f8da16fa1e01e8fbb5eb66a77e8f1db25cf05f66c62
MD5 2da9c274a12052b8c8795a4be1c5d805
SHA1 74aea5215f6633090dc0f15c724f1436b1509859
SHA512 94b4edc22cb297cf2f4cc18c705d93d52ad654a0dc0c4f56d54d766dd042b1a07f3be6de05efc7f5c0558178904b66be27d8cad09bfad0a22b88071c90b34b17
SSDEEP 768:uFQa3hwgnK3afF669yrqUjWiIwwxMtwb9Mz:Fa3VfF66INWZTMOb+z
TLSH
T1E4038D75EC94CA7BD9F6DB86B2513786DEE010A3C6D88EC8DAC89E0D04874DD1747C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0dfc5e59aa3afa63e6e96793121adc63b589e7e4019e0c3be129263264cb16c7
MD5 d7dc3732f987f878a85e26c29dd400df
SHA1 7a82d3be6a253656b50b5cec51cbeb33f4eb269e
SHA512 f8fc9bb4e47aa543801e5ab01693fef08e59712faa9f717593ea34b0c21ca4e6f7a52c08b97ec5ffedcad38dcdb07c162f6378fa11b842b5e0fa3e479ae38e83
SSDEEP 768:arv+4UNbdl3c1ykKL24jF669yrqUjWiIwwxMtwA:absbX3owjF66INWZTMOA
TLSH
T1A203AE70B9689AB3CDF6D685B1523383BF7410A396C50F98D9CDAB0D058B4DD274B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ef8386b43ba9a1df407be1b9cf41aee8c51954ac281c64e5d56bb832e6eee1e3
MD5 955662d3bbebb2cca92360471294e0f8
SHA1 30958cbb46308a65092803af4790b1c17dac76ed
SHA512 f91eba672cd98230b248f8e04c26856400c59ebd84e429d2490dbe681211c0162b689f75ba2baea38c4b7e282ca242ecdd800713d5bcb1189f72a7ed9f766e2f
SSDEEP 768:Ra3p3WkKL24jF669yrqUjWiIwwxMtwb9Mz:Ra3fwjF66INWZTMOb+z
TLSH
T1BDF2AE70BCA44EB3C9FAD78572523786AFB010A3D6D80E88D6DDE70D09475DD274782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 be65ca15f356170710a8ffd4c32e6e2d43e3c14401d00c94649e7af5227ca0e4
MD5 b4f8c7bccb4e1f0c7cbee07a0dc8f450
SHA1 caa699d184fe464491e588f49de27ee3415333aa
SHA512 df166e46a78055213d84a584b667cb56006375545e7a879083238036fc8bed9fa98772f6006513c8cf71c5d9847a0ea1d7149b56fc0e9baf8ff2f1e32d86c215
SSDEEP 768:SFQa3hwgnzTafF669yrqUjWiIwwxMtwb9Mz:pa36fF66INWZTMOb+z
TLSH
T1BF038D75EC94CA7BD9F6DB86B2513786DEE010A3C6D88EC8DAC89E0D04874DD1747C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 edd5d5d372ca5bed1ddefb1ec4718795af9f7f28fe54cb9b435e6cd629dad7f9
MD5 0abe4a7221c0111246b979bc7ad06add
SHA1 947e7bece8c800a9da6f4cc9a424d2e0e8f57e6c
SHA512 1a62509cc1b26cb3425713523bea04f43c179255d7c235f08e64b6791e9144da840d4e6fa455ed58fd33f7cac7aebff5f886312b0cdae7e27bd2c33b7cff114a
SSDEEP 768:arv+4UNbdl3WPkKL2MjF669yrqUjWiIwwxMRZUiler:absbX3dUjF66INWZTMDUsQ
TLSH
T16603CE35AC589AB7CDF2D68672433783BFB4109396C50B88CADD670D469B0DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45581828-a2d8-4bb1-9d3a-c1598f39c6f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\45581828-a2d8-4bb1-9d3a-c1598f39c6f8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

7711d21c-e7d6-44ff-bc6c-efef5350ae0a.tmp

Path C:\Users\Admin\AppData\Local\Temp\7711d21c-e7d6-44ff-bc6c-efef5350ae0a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf

Path C:\Users\Admin\AppData\Local\Temp\FICHA DE IDENTIFICACAO CIVIL_8332015651.pdf
Size 1.1MB
SHA256 37917cf204a6c12176935d79d08780e8ee25f44a5bc0a25bbde4c24441e600ea
MD5 b2477a4ff91af2fff5820949ed206d0d
SHA1 36f12a3d219e23c781775e0619ea5e7c22a57d6d
SHA512 74e677e5e71b805b52dacc1791d696e36b3afca2cfc1f4824ec1fb2349165532e22249837247b51ba9e8461cc5c3c3baa503a7e3c3a1de59660eac1065362eef
SSDEEP 24576:bUFK7BXVrP0csGpkfVMTO/nnbO1a5EO0HzyQGTtM1CQINScum:bUFKtXVrP0d90O/nbO1aCO2CcCQI3
TLSH
T18435231B3D0EC6814B90C4D97F432C52526BF7489C8552F6B4F28AEF5D68D28ADCF60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\_asyncio.pyd
Size 72KB
SHA256 c77de90cad749087a0c5dc5e19d78d24f6ef44e7e5ac19b8420cfc0cea62395d
MD5 0ad3abc085f1d954eff9dfa83039ebb7
SHA1 edb66b8223c3897a72b171f221934a4fee9dc24e
SHA512 76bbe6a89a11a946e4901a8321c3b9f02cbd6a36dfb42dfdf5be00ae78cf5b699d74bd2f1af0c6f0b0c12fc91d1f400e5eb80ed7792f4bea8c6aee212d368d15
SSDEEP 1536:cFOnRUrojeb8eUAN8bvobyjBIWOnsytH/9qUfIZR6/:cserQege3N8bvFBIWOn8Zw
TLSH
T1F6738DC6A2A4418BDD93B274C5636F93FBB0F6421501475F61A8C28E2F6379183FE726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\_bz2.pyd
Size 84KB
SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
MD5 2be172c3086efe56c7e1d3279142295a
SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
TLSH
T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\_ctypes.pyd
Size 124KB
SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
MD5 9314ab9707985aaf6e234b5c1fc3c3c6
SHA1 e8ba1f40f800397e3e6a7f95ffe2b9f63bf812ed
SHA512 a8436ccbc32dd31694d3a66072fa76933a2ecf0ef5eaa0b79380e6c53c8e8bd0bfaf7fe9341c17ced215792f3990f4ef220049da92dd4991ebc1d83ef3d41484
SSDEEP 3072:SxVJxKqXCjbqPzMM+kffELENy/Zq4e4lIWLPhG:UHxKsCbqbffELCya4c
TLSH
T197C35B0B739410A6EBA35178C5B36F07E7B1B42B171183CF02A4C6992F637A36E6E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\_hashlib.pyd
Size 67KB
SHA256 03d233dbace599168eaffec823de6ed7beec8c2a4ebfe9b8a3d8e042a59af3ba
MD5 72b2f8cdf8d6b1dbbdd4e0c0bacf849e
SHA1 54d10c68abecefa52f866bd13779544616c6b286
SHA512 827bd7f6aaad7184b3bce810d027055e15818208c8b167ef467bfb21d83103ff24f6d90fe0a500297a93d66d5cddd41eb1cb632f124171b042506a417d5eb15c
SSDEEP 1536:gksa/wmb96DB9qWptC8SBIWOIuytH/9SfIW44z4r:gHH9qWptClBIWOIBW4IQ
TLSH
T1B3639E0AB6944194D9A78175C9A39F53F9F1F28217206BEF4268C0CD2F233C3A77A756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\_lzma.pyd
Size 157KB
SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
MD5 7c25a079b992919cc97221955dac050c
SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
TLSH
T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\_overlapped.pyd
Size 55KB
SHA256 662126ff80c3a1b4cedf74074029c12ae4743e6d3b37376e39ac70aacb7d4d3c
MD5 a7fa2fbc0ae8c41a1911aed0703d37b7
SHA1 8f88ad4e9b152844867584d91e9883ff38444286
SHA512 aa99635e398092c2375e6fb4f0c4fefe1a376e564a9b2cee48a8840b2208b306314d53134ae9384033d899070a994107ed8809d5c8206c8517d518efe3b7d33c
SSDEEP 1536:V+rYIgKZPXjCJP+s1wIDmdIWXtnytH/9XfIik:tJP+s1wIDmdIWXtxz
TLSH
T162438D0A679400DAEE73D279D1678E07FB74B2D35610A31F60A8D68E1F73792A71E384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\_queue.pyd
Size 32KB
SHA256 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
MD5 6ffc75670dfed859cc7ca266bcc89816
SHA1 5a39c3fd8fb398234611b91a5da260547442da52
SHA512 d26d74232dce6c6e57c92a0cfae605bbef7036dd848a04ca8b267aeee1aa12b1b06813746466ce186c363b3c89034424ee64681399b8d00f4d4e997abfef475b
SSDEEP 768:eVzlP6rT1wyzklIWQUFOytxJEKrLy2Ip44Cxf1mljr8VMSU:eTST1lzklIWQU4ytH/9pfI38VMJ
TLSH
T164E29FCAAE644047E563CA70C2E7EE93F935B7935601879F2065C18E1F237C1E726329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\_socket.pyd
Size 83KB
SHA256 3efa4636cf9e350856f6927d67a4c2564bf9bd2758a00bbf17d3aece5b60016d
MD5 0106ee3f61a54d922190b3a01c81a453
SHA1 420bd90297b2df30f00813e4ee17177fa0c77c3b
SHA512 393bb603efa2f1fb783f2a9b898911af0882ff5919c2b3cf615845a349662b7b64d276398187b11f2c5c07a022459dd8d8b41c0ce331bc31c5f088056da7083c
SSDEEP 1536:BdcydNg46ARGrwISALqwXV9/s+S+pzgMX49IEuDQ6JnlIWLwhmytH/9hjCfIbp:B6ydCA0c6qwXV9/sT+pzgV9IbDTJnlIR
TLSH
T193835A10A6A051FAEB63D075C2639F63FBB4B6C12395935F1092C65E1F33782AE39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\_ssl.pyd
Size 175KB
SHA256 0bc527d2dbc50009f43b2ed5d5982c4f63f4b647647ffa9eda612dcda80f6040
MD5 ed9242721197fd84231b38e6b42f3f55
SHA1 4333b9d43a120a6528f63cdba798c8153e8bfdfa
SHA512 9b4b94f6bf927c07e2e63bc6ee6140ec090c3063dee920d609dc49cb5ce30653ca2e32f4d6f700969082b79b836a276aa1c2fb17cf53f02c2d4f207a1f0d3552
SSDEEP 3072:l+59j9Gd6wNsBjj903ff6X32RP0o/aC6osf87vOifHZHmziXpIWC7Cz:l+v9Gd6BtGPf6X3fUaC+2Xp
TLSH
T1F2048D47B5841AB7D813E4F9C2234903DBB1F155331257DE48D6E6890F03B4AAEBAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\_wmi.pyd
Size 39KB
SHA256 a980f1e7a29842bd946863fc2693fbeb555a9dc0f9e1630dfed9a2fcdef3ece2
MD5 c7427027acbd9a0076b598fc71ee45a5
SHA1 cc2ab52f295e588f8bc99f23cc25467d7bfd9732
SHA512 e9ea1748c317b8439425306d44593a1210c552bd28cdbb20df2bf8e18041ea76d1c666e5fd2cc03268d48b5982f01de71136a079f083f4a62cab06d91fd114f4
SSDEEP 768:iEkKOex+l0WgNQqDpIWCiWOytxJEKrLy2Ip44oTxf1mltPRVQgM:iE9OtyNQqDpIWCiJytH/94UfIZReF
TLSH
T1DB037D89E6A80046EA63DBB5C9A6CE53F471B7D35B11D38F365582990F233C0E739329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\base_library.zip
Size 1.3MB
SHA256 9b954fb09bfa4d1c9d228015ce08a668cb3018db3b417707d147c5fd9711bfd9
MD5 e99e882e8b59dbeb78c4b396481c6965
SHA1 21e4118be2fecca96075f8c80b58bed91528bd96
SHA512 825295d95631df8ddef7a44ec3ef77ab9c2149e5657b6937410d33af64d9a9c3bbe7b5cf0062587cfd35eb828d136fe3b8c30cc69b8139558c4ef31f3679ac3c
SSDEEP 12288:J9Wg+nVTVihlyixmpvQXMHYv/s808lJGUmwHbP1dmTRgNg32/H2rmn9oeT:J9ch6Q8lJGUDbP1dmTL2/H269pT
TLSH
T1CA55D6817A92A5B3FC84F3BA04260A0EA3658571BF44C747389FC5E56F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\pyexpat.pyd
Size 200KB
SHA256 d615e193d1affcdbfe504e90d3621cbdcff94bf72b79d899126534507fd6d27a
MD5 bf66989dd870664848467c327bdbe1a8
SHA1 958992cdf2e7cec3036a569dac4823657fabc13d
SHA512 6471c3254ba457a82cac1842f3030750d63ecc66177143d8489db36e5d94fd0e6542297091241e37c9bcb407aeb7000959ba3cad1fd6195c96f5fd564262ebe4
SSDEEP 3072:+AxcwUmy8gbvOH4gUkjMVClyzPBOBGNVzv40nGd9pbCRd9p9d9phd9pGJ37Ri9Ng:BUmy8gbvOWkjMVClyzZOgH2C9TbKX
TLSH
T121145C4BB2A6C09BD8538038D6D78B07DAB1B86503808BDF66D4E77D9F2B7413B29315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\python3.DLL
Size 68KB
SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
MD5 962428e9e68d43ecc16f3e33f2ea8667
SHA1 6d0f349ab2e795b138a64346b784fc7fcdb6d87f
SHA512 a925586bbc4cc9d2f58f5b6eeed82e429c23dd57d7b33609c0067fc14ed66ed165ac8121eeec1db3f993412f28ba527e961e3d6bcc201d4cda2037f85931ffc5
SSDEEP 768:BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/s:BDmF61JFn+/OulIWL0vytH/9ifITgj
TLSH
T125637042BB54F893DBFA66FC7AD199CE642B12CC572984ECA47593D30D1A310A2E334D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\python312.dll
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32322\select.pyd
Size 32KB
SHA256 d4d7181b11db0bd22a6cd5cda6f8583d1f5c77615fd0a6ca33350619d6e0438a
MD5 74b93bc6c37d47011f92024f060c6784
SHA1 0e9cd2e881ad58818fc75b1fda765841995a92dd
SHA512 7c92a9c3d676ebf5211b93c7e44cbc77e17925d2ccaba97aa9b52d3fb4050e746ea4a86e82f9553717ddeffade3aaf518563a442578899bc05d65cac57031b58
SSDEEP 768:gFOLHfEDnlIWQGiOytxJEKrLy2Ip4MTxf1mltPRVugwH:gFOL/EDnlIWQG9ytH/9gfIZRsXH
TLSH
T146E27D8AAB245087F963CA7186A2CE43F939B7E3471146CF30A5D2991E237C1B73A355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lh2kte97

Path C:\Users\Admin\AppData\Local\Temp\lh2kte97
Size 4B
SHA256 f02285fb90ed8c81531fe78cf4e2abb68a62be73ee7d317623e2c3e3aefdfff2
MD5 3f1d1d8d87177d3d8d897d7e421f84d6
SHA1 dd082d742a5cb751290f1db2bd519c286aa86d95
SHA512 2ae2b3936f31756332ca7a4b877d18f3fcc50e41e9472b5cd45a70bea82e29a0fa956ee6a9ee0e02f23d9db56b41d19cb51d88aac06e9c923a820a21023752a9
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4856_1197261627\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads